Cheaters are not Secure Boot enjoyers, because by turning it on, they lose access to one of the more convenient ways to bypass Driver Signing Enforcement and PatchGuard, meaning they can’t load their unsigned malware. In tandem with driver attestation, this dramatically reduces the kernel surface that Vanguard need be wary of.

2. Trusted Platform Module 2.0

The TPM 2.0 chip is a secure cryptoprocessor embedded on a PC’s motherboard (dTPM) or integrated into the CPU’s firmware (fTPM), for which the primary function is generation, storage, and retrieval of cryptographic keys. It operates with 100% logical independence from the device’s processor and RAM, meaning the keys are not directly exposed to the operating system or any software running on it. So, if you’re an anti-cheat developer, this immutable secret store is the equivalent of a digital one-way mirror, and if you’re an aspiring cheater, you can do only the equivalent of pressing your face against the glass.

The TPM is a necessary requirement for the very same driver attestation service we’ve championed above, but more importantly, it also works beautifully as a non-fungible form of hardware identity. A TPM’s Endorsement Key is physically burned into its non-volatile memory at the factory, so if we were to decide to ban this key on sight, any cheater hoping to bypass that ban would need to physically remove and replace their banned chip, or even more amusingly, replace the entire CPU, just to avoid re-detection. For the purposes of satisfying Vanguard Pre-Check, either discrete or firmware TPMs are considered sufficient, but if an account is restricted, only an fTPM will do. 

Vanguard Restrictions are placed on accounts that are too “botty,” “cheaty,” or “speedy,” necessitating that they meet certain hardware requirements in order to continue further into the competitive ecosystem. It’s a lot like saying “we literally dare you to enable your fTPM,” and perhaps unsurprisingly, most cheaters find themselves unwilling to do that, resulting in their immediately abandoning the account they’ve clearly stolen. That said, we can only allow fTPMs to satisfy this requirement, because discrete TPMs are often not even soldered to the motherboard anymore, and we think a hardware ban bypass should cost more than $5 and the 10 minutes it takes to pop in a new one. 

3. IOMMU

The Input-Output Memory Management Unit is a piece of hardware that acts as a firewall between PCIe devices and system memory. Without one, when a DMA request is made from a $6000 cheating peripheral, it is directly asking the memory controller for a raw, physical address in RAM, and this creates an unmitigated disaster of access policy violations where any cheater can undetectably browse the game client’s memory for anything they might be interested in, like exactly what a radar cheat does. 

But once the IOMMU enters the game, those devices are no longer allowed to access physical RAM directly, and instead, they must use only virtual addresses over the unit itself, which relies upon a translation table to get the real, physical one. This gives us the opportunity to mark game memory as unreadable, forcing the translation process to throw a hardware fault, and forcing the cheater to stare into their reflection on a black computer monitor when they try to cheat in our games.

Proper enforcement of IOMMU requires that the device’s corresponding DMA driver have support for memory remapping, and like many examples in this article, there are a few, exasperating devices that are still used by a good percentage of players but do not yet have the necessary support. This makes some annoying gaps in its protections that we must deal with, but rest assured that we are dealing with them. For the last year, we’ve been surgically placing full IOMMU restrictions onto high-ranked VALORANT cheaters that are abusing DMA, immediately rendering their wallet useless. 

IOMM me?